377 matches found
CVE-2018-13309
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...
CVE-2018-13309
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...
Beyond Remote 2.2.5.3 - Denial of Service (PoC)
Exploit Title: Beyond Remote 2.2.5.3 - Denial of Service PoC Author: Erenay Gencay Discovey Date: 2018-09-24 Vendor notified : 2018-09-24 Software Link: https://beyond-remote-client-and-server.jaleco.com/ Tested Version: 2.2.5.3 Tested on OS: Windows XP Professional sp3 ENG Steps to Reproduce: Ru...
Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2019-03472)
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the 'password' parameter of the users/registration page in...
CVE-2018-14668
“remote” table function allowed arbitrary symbols in “user”, “password” and “defaultdatabase” fields which led to Cross Protocol Request Forgery Attacks. Andrey Krasichkov of Yandex Information Security Team...
CVE-2018-7477
SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parentmodule/parentlogin.php...
CVE-2017-11508
SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could exploit this vulnerability by entering a crafted SQL query into the password field of a...
[R1] SecurityCenter 5.6.0 Fixes One Vulnerability
SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could exploit this vulnerability by entering a crafted SQL query into the password field of a...
Moxa MXView 2.8 Denial Of Service
Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MOXA-MXVIEW-v2.8-DENIAL-OF-SERVICE.txt + ISR: ApparitionSec Vendor: ============ www.moxa.com Product: =========== MXView v2.8 Download:...
Web Based TimeSheet Script Authentication Bypass Vulnerability
web based timesheet is a program to monitor the work of your employees. An authentication bypass vulnerability exists in the Web Based TimeSheet script that requires the string 'or' '=' to be entered where the password is filled in, which can be exploited by an attacker to bypass authentication...
Nextcloud: Missing Rate Limit for Current Password field in nextcloud.com
There is no rate limit enabled for "Current Password" field on Setting page of nextcloud.com. A malicious minded user can continually tries to brute force an account password...
The vulnerability of the D-Link DSR-250 router’s microprogramming software allows a malicious individual to gain administrator privileges.
The script “/scgi-bin/platform.cgi” of the D–Link DSR–250 router operating system does not properly filter the data entered by the user in the “Password” field. As a result, a malicious individual can bypass the authentication process and gain access to the device with administrator privileges...
The vulnerability of the microprogrammed routing software D–Link DSR–1000, which allows a malicious individual to gain administrator privileges
The script “/scgi-bin/platform.cgi” of the D–Link DSR–1000 router’s software does not filter the data entered by the user in the “Password” field properly. As a result, a malicious individual can bypass the authentication process and gain access to the device with administrator privileges...
The vulnerability of the microprogrammed software of the D–Link DSR–500 router allows a malicious individual to gain administrator privileges.
The script “/scgi-bin/platform.cgi” of the D–Link DSR–500 router’s software does not properly filter the data entered by the user in the “Password” field. As a result, a malicious individual can bypass the authentication process and gain access to the device with administrator privileges...
CVE-2016-3188
The prepopulaterequestwalk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the 1 actions, 2 container, 3 token, 4 password, 5 passwordconfirm, 6 textformat, or 7 markup field type, and consequently have unspecified impact, via unspecified...
CVE-2015-7928
eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...
Design/Logic Flaw
eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...
CVE-2015-7928
eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...
CVE-2015-1933
IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX001 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli ...
